Help Please - AntispywareXP 2009 infection

docpaulo · Oct 31, 2008

Hi folks. found your site today and it's already been a great help, but I'm hoping you can give some advice to a malware newbie on how to fix my current problem.
Yesterday I came back from a few day's holiday to find that my son had managed to infect our PC with AntispywareXP 2009! In addition to the annoying constant popup messages it had deleted several .exe files from the system, including AVG, Ccleaner, Spybot S&D, printer utilities etc. and disabled ZoneAlarm firewall & blocked access to MS Office.
I searched for removal tools and found instructions on another site that advised the use of Malwarebytes' Anti-Malware. I used that and it removed multiple files. I then installed and ran SuperAntiSpyware which removed a couple more files. ZoneAlarm is working again & I repaired MS Office access but the missing .exe files haven't returned. I tried to use system restore but it can't return to a point before the infection.
I then found the READ & RUN ME FIRST instructions on this site. I followed the whole process through (inc. running Anti-Malware & SuperAntiSpyware again). I'm attaching the logs - the latter prog. logs show before & after removal. Please advise!

docpaulo · Oct 31, 2008

..and here is the MGtools log file.

TimW · Nov 1, 2008

Not to bad.....just a few things to remove....

download The Avenger by Swandog469, and save it to your Desktop.

* Extract avenger.exe from the Zip file and save it to your desktop
* Run avenger.exe by double-clicking on it.
* Do not change any check box options!!
* Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

Files to delete:
C:\Documents and Settings\Hand Family\Local Settings\Application Data\eboxyvamet.lib
C:\Documents and Settings\Hand Family\Local Settings\Application Data\nycavevu.vbs
C:\Documents and Settings\Hand Family\Local Settings\Application Data\uwalucefam._sy
C:\Documents and Settings\All Users\Application Data\ibonev~1.bat
C:\Documents and Settings\All Users\Application Data\ityxyn.scr
C:\Documents and Settings\All Users\Application Data\konojef.pif
C:\Program Files\Common Files\utetas._dl
C:\Program Files\Common Files\ydovitof.lib
C:\Program Files\Common Files\yvyromax.db
C:\WINDOWS\finitu._dl
C:\WINDOWS\ibaj.reg
C:\WINDOWS\xowobix._sy
C:\WINDOWS\ymovej~1.com
C:\WINDOWS\system32\macyh.exe
Click to expand...

* Now click the Execute button.
* Click Yes to the prompt to confirm you want to execute.
* Click Yes to the Reboot now? question that will appear when Avenger finishes running.
* Your PC should reboot, if not, reboot it yourself.
* A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

Also delete all files in the below folders except ones from the current date (Windows will not let you delete the files from the current day).
C:\WINDOWS\Temp
C:\Documents and Settings\%username%\Local Settings\Temp

Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this and also attach the log from Avenger.

docpaulo · Nov 1, 2008

Many Thanks TimW. I'm really grateful for your help.
I followed your instructions. During the reboot after Avenger ran, the attached Windows error message appeared (error.jpg). I clicked continue and it disappeared. Everything seems to be OK so far.
The MGtools GetLogs seemed to run OK - I've attached the logs.zip and the Avenger log as requested.
Let me know if you need any more info.

regards
Docpaulo

TimW · Nov 2, 2008

I missed one file.....please use windows explorer to find and delete:
C:\WINDOWS\qydohep.bat

If you are not having any other malware issues, then:

We recommed you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /u

Notes: The space between the combofix" and the /u, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Delete the C:\combofix folder from combofix (if it exists)

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip

If you are running Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Click to expand...

docpaulo · Nov 2, 2008

That's great TimW. I've deleted that extra file & cleaned up the system. The bad stuff seems to have gone away (for now at least!) I've also followed the guidance in the link on how to protect myself in future, inc. purchasing SuperAntiSpyware Pro for realtime protection.
I thought we were pretty well protected before, but this episode shows how wrong I was!
Many thanks once again for your help and much respect to all at MajorGeeks for the excellent guidance articles - without them I wouldn't have had a hope in hell of getting out of the mess I was in.

DocPaulo

TimW · Nov 2, 2008

You are most welcome....safe surfing.

Log in or Sign up

Help Please - AntispywareXP 2009 infection

docpaulo Private E-2

Attached Files:

SASlog.txt

mbam-log-2008-10-31 (08-27-56).txt

Combofix log.txt

docpaulo Private E-2

Attached Files:

MGlogs.zip

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

docpaulo Private E-2

Attached Files:

error.JPG

avenger.txt

MGlogs.zip

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

docpaulo Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member